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ABSTRACT 

We give a new version of the adversary method for prov- 
ing lower bounds on quantum query algorithms. The new 
method is based on analyzing the eigenspace structure of 
the problem at hand. We use it to prove a new and opti- 
mal strong direct product theorem for 2-sided error quantum 
algorithms computing k independent instances of a symmet- 
ric Boolean function: if the algorithm uses significantly less 
than k times the number of queries needed for one instance 
of the function, then its success probability is exponentially 
small in k. We also use the polynomial method to prove 
a direct product theorem for 1-sided error algorithms for 
k threshold functions with a stronger bound on the suc- 
cess probability. Finally, we present a quantum algorithm 
for evaluating solutions to systems of linear inequalities, and 
use our direct product theorems to show that the time-space 
tradeoff of this algorithm is close to optimal. 

Categories and Subject Descriptors 

F.1.2 [Computation by Abstract Devices]: Modes of 
Computation; F.1.3 [Computation by Abstract Devices]: 

Complexity Measures and Classes — Relations among com- 
plexity measures; F.2.3 [Analysis of Algorithms and Prob- 
lem Complexity]: Tradeoffs between Complexity Mea- 
sures 
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1. INTRODUCTION 

1.1 A new adversary method 

Most of the known quantum algorithms work in the black- 
box model of computation. Here one accesses the n-bit input 
via queries and our measure of complexity is the number 
of queries made by the algorithm. In between the queries, 
the algorithm can make unitary transformations for free. 
This model includes for instance the algorithms of Grover, 
Deutsch and Jozsa, Simon, quantum counting, the recent 
quantum walk-based algorithms, and even Shor's period- 
finding algorithm (which is the quantum core of his factoring 
algorithm) . 

Much work has focused on proving lower bounds in this 
model. The two main methods known are the polynomial 
method and the adversary method. The polynomial method 
|24l |S] works by lower-bounding the degree of a polynomial 
that in some way represents the desired success probability. 

The adversary method was originally introduced by Am- 
bainis 0. Many different versions have since been given 1191 
7, 4 21 30 , but they are all equivalent |29|. Roughly 
speaking, the adversary method works as follows. Suppose 
we have a T-query quantum algorithm that computes some 
function / with high success probability. Let \^pl.) denote 
the algorithm's state on input x after making the t-th query. 
Suppose X and y are two inputs with distinct function val- 
ues. At the start of the algorithm {t = 0), the states ji/j^) 
and [ipy) are the same (the input has not been queried yet), 
so their inner product is (V'SIV'b) = 1- But at the end of the 
algorithm {t = T), the inner product {■ip'^\ipy) must be less 
than some small constant depending on the error probabil- 
ity, otherwise the algorithm cannot give the correct answer 
for both X and y. The adversary method takes a (weighted) 
sum of such inner products (for x, y pairs with f{x) ^ f{y)) 
and analyzes how quickly this sum can go down after each 
new query. If it cannot decrease quickly in one step, then 
it follows that we need many steps and we obtain a lower 
bound on T. 

The two lower bound methods are incomparable. On the 
one hand, the adversary method proves stronger bounds 
than the polynomial method for certain iterated functions [l], 
and also gives tight lower bounds for constant-depth AND- 
OR trees |21 1181 . where we do not know how to analyze 
the polynomial degree. On the other hand, the polyno- 



mial method works well for analyzing zero-error or low-error 
quantum algorithms |S| I12| and gives optimal lower bounds 
for the collision problem and element distinctness 0. The 
adversary method fails for the latter problem (and also for 
other problems like triangle- finding) , because the best bound 
provable with it is O{y^C0{f)C^f)) Here C^if) 

and C^{f) are the certificate complexities of / on 0- inputs 
and 1-inputs. In the case of element distinctness and triangle- 
finding, one of these complexities is constant. Hence the 
adversary method in its present form(s) can prove at most 
an Q{\nV) bound, while the true bound is e(A''^''^) in 
the case of element distinctness and the best known algo- 
rithm for triangle-finding costs 0{N^''^^^'^) 2^ . A second 
limitation of the adversary method is that it cannot deal 
well with the case where there are many different possible 
outputs, and a success probability much smaller than 1/2 
would still be considered good. 

In this paper we describe a new version of the adversary 
method that does not suffer from the second limitation, and 
possibly also not from the first — though we have not found 
an example yet where the new method breaks through the 
VC^JWU) barrier. 

Very roughly speaking, the new method works as follows. 
We view the algorithm as acting on a 2-register state space 
Ha ^Hi- Here the actual algorithm's operations take place 
in the first register, while the second contains (a superpo- 
sition of) the inputs. In particular, the query operation on 
TIa is now conditioned on the basis states in Tii. We start 
the analysis with a superposition of 0-inputs and 1-inputs in 
the input register, and then track how this register evolves 
as the computation moves along. Let pt be the state of this 
register (tracing out the T^A-register) after making the t-th 
query. By employing symmetries in the problem's structure, 
such as invariances of the function under certain permuta- 
tions of its input, we can decompose the input space into 
orthogonal subspaces So,---,Sm- We can decompose the 
state accordingly: 

m 

Pt = ^Pt,i^i, 

where at is a density matrix in subspace Si. Thus the t- 
th state can be fully described by a probability distribution 
pt,o, ■ ■ ■ ,Pt,m that describes how the input register is dis- 
tributed over the various subspaces. Crucially, only some 
of the subspaces are "good", meaning that the algorithm 
will only work if most of the weight is concentrated in the 
good subspaces at the end of the computation. At the start 
of the computation, hardly any weight will be in the good 
subspaces. If we can show that in each query, not too much 
weight can move from the bad subspaces to the good sub- 
spaces, then we again get a lower bound on T. 

This idea was first introduced by Ambainis in and used 
there to reprove the "strong direct product theorem" for 
the OR- function of |2U| (we'll explain this in a minute). In 
this paper we extend it and use it to prove direct product 
theorems for all symmetric functions. 

1.2 Direct product theorems for symmetric 
functions 

Consider an algorithm that simultaneously needs to com- 
pute k independent instances of a function / (denoted j''"^). 
Direct product theorems deal with the optimal tradeoff be- 
tween the resources and success probability of such algo- 



rithms. Suppose we need t "resources" to compute a single 
instance f{x) with bounded error probability. These re- 
sources could for example be time, space, ink, queries, com- 
munication, etc. A typical direct product theorem (DPT) 
has the following form: 

Every algorithm with T < akt resources for com- 
puting Z'''' has success probability a < 2"^^*^' 
(where q > is some small constant). 

This expresses our intuition that essentially the best way to 
compute /^*' on k independent instances is to run separate 
t-resource algorithms for each of the instances. Since each 
of those will have success probability less than 1, we expect 
that the probability of simultaneously getting all k instances 
right goes down exponentially with k. DPT's can be stated 
for classical algorithms or quantum algorithms, and a could 
measure worst-case success probability or average-case suc- 
cess probability under some input distribution. DPT's are 
generally hard to prove, and Shaltiel '28' even gives gen- 
eral examples where they are just not true (with a average 
success probability), the above intuition notwithstanding. 
Klauck, Spalek, and de Wolf |2U) recently examined the case 
where the resource is query complexity and / = OR, and 
proved an optimal DPT both for classical algorithms and 
for quantum algorithms (with a worst-case success proba- 
bility). This strengthened a slightly earlier result of Aaron- 
son 2 , who proved that the success probability goes down 
exponentially with k if the number of queries is bounded by 
a\/^kn rather than the aky/n of [20) . 

Here we generalize their results to the case where / can 
be any symmetric function, i.e., a function depending only 
on the Hamming weight \x\ of its input. In the case of 
classical algorithms the situation is quite simple. Every n- 
bit symmetric function / has classical bounded-error query 
complexity R2{f) = 0(n) and block sensitivity bs{f) = 
0(n), hence an optimal classical DPT follows immediately 
from I2UI Theorem 3]. Classically, all symmetric functions 
essentially "cost the same" in terms of query complexity. 
This is different in the quantum world. For instance, the 
OR function has bounded-error quantum query complexity 
(32 (OR) = Q{^/n) |17llll| . while Parity needs n/2 quantum 
queries |H1 115| . If / is a t-threshold function {f{x) = 1 iff 
ia;| > t, with t < n/2), then Q2(,/) = e{Vtn) ^. 

Our main result is an essentially optimal quantum DPT 
for all symmetric functions: 

There is a constant a > such that for every 
symmetric / and every positive integer k: Ev- 
ery 2-sided error quantum algorithm with T < 
akQ2{f) queries for computing has success 
probability a < 2^"''='. 

Our new direct product theorem generalizes the polynomial- 
based results of |2()| (which strengthened the polynomial- 
based [5]), but our current proof uses the above-mentioned 
version of the adversary method. 

We have not been able to prove this result using the 
polynomial method. We can, however, use the polynomial 
method to prove an incomparable DPT. This result is worse 
than our main result in applying only to 1 -sided error quan- 
tum algorithms^ for threshold functions; but it's better in 

^The error is 1-sided if 1-bits in the fc-bit output vector are 
always correct. 



giving a much stronger upper bound on the success proba- 
bility; 

There is a constant a > such that for every t- 
threshold function / and every positive integer k: 
Every 1-sided error quantum algorithm with T < 
akQ2{f) queries for computing f^'"^ has success 
probability a < 2-"('''). 

A similar theorem can be proven for the fc-fold t-search prob- 
lem, where in each of k inputs of n bits, we want to find at 
least t ones. The diflterent error bounds 2""('=*' and 2""'''') 
for 1-sided and 2-sided error algorithms intuitively say that 
imposing the 1-sided error constraint makes deciding each of 
the k threshold problems as hard as actually finding t ones 
in each of the k inputs. 

1.3 Time-Space tradeoffs for evaluating solu- 
tions to systems of linear inequalities 

As an application we obtain near-optimal time-space trade- 
offs for evaluating solutions to systems of linear equalities. 
Such tradeoffs between the two main computational resources 
are well known classically for problems like sorting, element 
distinctness, hashing, etc. In the quantum world, essentially 
optimal time-space tradeoffs were recently obtained for sort- 
ing and for Boolean matrix multiplication |2U|. but little else 
is known. 

Let A be a fixed N x N matrix of nonnegative integers. 
Our inputs are column vectors x — {xi, . . . ,xn) and b = 
(6i,...,6jv) of nonnegative integers. We axe interested in 
the system 

Ax>b 

of A'^ linear inequalities, and want to find out which of these 
inequalities hold (we could also mix >, =, and <, but omit 
that for ease of notation).^ Note that the output is an A''- bit 
vector. We want to analyze the tradeofi' between the time 
T and space S needed to solve this problem. Lower bounds 
on T will be in terms of query complexity. For simplicity we 
omit polylog factors in the following discussion. 

In the classical world, the optimal tradeofi^ is TS = , 
independent of the values in b. This follows from I2UI Sec- 
tion 7]. The upper bounds are for deterministic algorithms 
and the lower bounds are for 2-sided error algorithms. In 
the quantum world the situation is more complex. Let us 
put an upper bound max{6i} < t. We have two regimes for 
2-sided error quantum algorithms: 

• Quantum regime. If 5* < A/t then the optimal tradeofi^ 
is T^S = tN^ (better than classical). 

• Classical regime. If S' > N/t then the optimal tradeofi^ 
is TS = N'^ (same as classical) . 

Our lower bounds hold even for the constrained situation 
where b is fixed to the sll-t vector, A and x are Boolean, 
and A is sparse in having only 0{N/S) non-zero entries in 
each row. 

Since our DPT for 1-sided error algorithms is stronger by 
an extra factor of t in the exponent, we obtain a stronger 
lower bound for 1-sided error algorithms: 

• li t < S < N/t^ then the optimal tradeoff for 1-sided 
error algorithms is T^S > t^N^. 

^Note that if A and x are Boolean and 6 — (t, . . . ,t), this 
gives A^ overlapping f-threshold functions. 



• \l S > N/t^ then the optimal tradeoff for 1-sided error 
algorithms is TS = N^. 

We do not know whether the lower bound in the first case 
is optimal (probably it is not), but note that it is stronger 
than the optimal bounds that we have for 2-sided error al- 
gorithms. This is the first separation of 2-sided and 1-sided 
error algorithms in the context of quantum time-space trade- 
offs. 

Remarks: 

1. Klauck et al. [HI gave direct product theorems not only 
for quantum query complexity, but also for 2-party quantum 
communication complexity, and derived some communication- 
space tradeoffs in analogy to the time-space tradeoffs. This 
was made possible by a translation of communication pro- 
tocols to polynomials due to Razborov 26j, and the fact 
that the DPTs of 20 were polynomial-based. Some of the 
results in this paper can similarly be ported to a communi- 
cation setting, though only the ones that use the polynomial 
method. 

2. The time-space tradeoffs for 2-sided error algorithms 
for Ax > b similarly hold for a system of A' equalities. Ax = 
b. The upper bound clearly carries over, while the lower 
holds for equalities as well, because our DPT holds even 
under the promise that the input has weight t or t — 1. 
In contrast, the stronger 1-sided error time-space tradeoff 
does not automatically carry over to systems of equalities, 
because we do not know how to prove the DPT with bound 
2-»(kt) under this promise. 

2. PRELIMINARIES 

We assume familiarity with quantum computing 123' and 
sketch the model of quantum query complexity, referring 
to 13 for more details, also on the close relation between 
query complexity and degrees of multivariate polynomials. 
Suppose we want to compute some function /. For input 
X € {0, l}'^, a query gives us access to the input bits. It 
corresponds to the unitary transformation 

Ox ■ \i,b,z) ^ \i,b<S Xi,z). 

Here i £ [A] = {1, . . . , A} and b G {0, 1}; the z-part cor- 
responds to the workspace, which is not affected by the 
query. We assume the input can be accessed only via such 
queries. A T-query quantum algorithm has the form A = 
UtOxUt~i ■ ■ ■ OxUiOxUo, where the Uk are fixed unitary 
transformations, independent of x. This A depends on x 
via the T applications of Ox- The algorithm starts in ini- 
tial S'-qubit state |0) and its output is the result of measur- 
ing a dedicated part of the final state A\Q). For a Boolean 
function /, the output of A is obtained by observing the 
leftmost qubit of the final superposition ^|0), and its accep- 
tance probability on input x is its probability of outputting 
1. We mention some well known quantum algorithms that 
we use as subroutines. 

• Quantum search. Grover's search algorithm |17II1U| 
can find an index of a 1-bit in an n-bit input in ex- 
pected number of 0{^n/ (|x| -1-1)) queries, where |a;| 
is the Hamming weight (number of ones) in the input. 

^Strictly speaking, there's a quadratic gap for OR, but space 
logn suffices for the fastest 1-sided and 2-sided error algo- 
rithms so there's no real tradeoff in that case. 



If ]a;] is known, the algorithm can be made to find 
the index in exactly 0{^Jn/ {\x\ + 1)) queries, instead 
of the expected number By repeated search, we 

can find t ones in an n-bit input with \x\ > t, using 
T,[t\a,\-t+i 0{\Jnl (i + 1)) = 0{Vtn) queries. 

Quantum counting [111 Theorem 13]. There is a 
quantum algorithm that uses M queries to n-bit x to 
compute an estimate to of |a::| such that with probabil- 
ity at least 



< 2tt 



\/\x\{n - \x\) 
M 



A/2' 



For investigating time-space tradeoffs we use the circuit model. 
A circuit accesses its input via an oracle like a query al- 
gorithm. Time corresponds to the number of gates in the 
circuit. We will, however, usually consider the number of 
queries to the input, which is obviously a lower bound on 
time. A circuit uses space S if it works with S bits/qubits 
only. We require that the outputs are made at predefined 
gates in the circuit, by writing their value to some extra 
bits/qubits that may not be used later on. 

3. DIRECT PRODUCT THEOREM FOR 
SYMMETRIC FUNCTIONS (2-SIDED) 

The main result of this paper is the following theorem. 

Theorem 1. There is a constant a > such that for 
every symmetric f and every positive integer k: Every 2- 
sided error quantum algorithm with T < akQ2{f) queries 
for computing /'■'^' has success probability a < 2~^''°' . 

Let us first say something about Q2{f) for a symmetric 
function / : {0, 1}" {0, 1}. Let t denote the smallest 
nonnegative integer such that / is constant on the interval 
\x\ G [t,n — t]. We call this value t the "implicit threshold" 
of /. For instance, functions like OR and AND have t — 1, 
while Parity and Majority have t — n/2. If / is the t- 
threshold function, then the implicit threshold is just the 
threshold. The implicit threshold is related to the parameter 
r(/) introduced by Paturi [53 via t = n/2 - r(/)/2 ± 1. It 
characterizes the bounded-error quantum query complexity 
of /: Q2{f) = Q{Vtn) [HI- Hence our resource bound in 
the above theorem will be ak\/tn for some small constant 
a > 0. 

We actually prove a stronger statement, applying to any 
Boolean function / (total or partial) for which f(x) = if 
\x\ = t — 1 and f{x) = 1 if |a::| = t. In this section we give an 
outline of the proof. Most of the proofs of technical claims 
are deferred to [Appendix A| 

Let A be an algorithm that computes k instances of this 
weight-(t — 1) versus weight-t problem. We recast A 
into a different form, using a register that stores the in- 
put x^ , . . . ,x''. Let Ha be the Hilbert space on which A 
operates. Let Tii be an + (") )'°-dimensional Hilbert 

space whose basis states correspond to inputs {x^ , . . . ,x'') 
with Hamming weights G {t—l,t},..., \x''\ € {t~ l,t}. 
We transform A into a sequence of transformations on a 
Hilbert space TC = TCa <8> Hi. A non-query transformation 
U on Ti.A is replaced with U ® I onTi. A query is replaced 
by a transformation O that is equal to O^,! ® I on the 
subspace consisting of states of the form \s)a ®\x^ . . . x^)i. 



The starting state of the algorithm on Hilbert space TL is 
\<Po) = |V'start)A ® |V'o)/ whcrc IV'start) is the Starting state 
of A as an algorithm acting on TIa and |i/'o) ~ |^/'one)®* is a 
tensor product of k copies of the state |i/'one) in which half 
of the weight is on \x) with \x\ — t, the other half is on 
with \x\ = t — 1, and any two states |a;) with the same 
have equal amplitudes: 



\tpone) 



X : I X I — 



Let \ipd) be the state of the algorithm A, as a sequence of 
transformations on Ti., after the d-th query. Let pd be the 
mixed state in Tii obtained from \ipd) by tracing out the TCa 
register. 

We define two decompositions of Tii into a direct sum 
of subspaces. We have Hi = {Hone)®'^ where Hone is the 
input Hilbert space for one instance, with basis states |a;), 
X G {0,1}", |x| G {t-l,t}. Let 



E 



\Xl . 



■ x„) 



XiA \-Xn—t — l^ 

Xi^ —■■ - — Xi .—1 



and let . ) be a similar state with xi + ■ ■ ■ + Xn = t in- 

stead of a;i-|-- • ■+Xn — t—1. Let Tj^ (resp. Tj^i) be the space 
spanned by all states \'>pii,...,ij) (resp. )) and let 

Sj^a = Tj,a n Tj^i For a subspace S, we use Hs to denote 
the projector onto S. Let lil^f^ ^^) = Hj,± ■ For 

j < t, let Sj^+ be the subspace spanned by the states 



and Sj,- be the subspace spanned by 

For j = t, we define St,- ~ St,i and there is no subspace 
St,+. Thus Hone = 0*Io('S'j,+ ® Sj,-) ^t,- . Let us try to 
give some intuition. In the spaces and Sj,-, we may be 
said to "know" the positions of j of the ones. In the Sj,- 
subspaces we have distinguished the 0-inputs from 1-inputs 
by the relative phase, while in the Sj,+ subspace we have not 
distinguished them. Accordingly, the algorithm is doing well 
on this one instance if most of the state sits in the "good" 
subspaces Sj,-. 

For the space Hi (representing k independent inputs for 
our function) and ri, . . . ,rk G {+, — }, we define 



5". 



31,----Jk,ri,...,rk 



Let Sm- be the direct sum of all Sji,...j^,ri,...,rfc such that 
exactly m of the signs ri, . . . , are equal to — . Then Hi = 
®„5m-. This is the first decomposition. 

The above intuition for one instance carries over to k 
instances: the more minuses the better for the algorithm. 
Conversely, if most of the input register sits in Sm- for low 
m, then its success probability will be small. More precisely, 
in [Appendix we prove: 

Lemma 2. Let p be the reduced density matrix of Hi. If 
the support of p is contained in So- © 5i_ © • • • ® Sm- , then 



the probability that measuring TIa gives the correct answer 

Em ( ^ \ 

m'— \m'/ 



is at most 



2*= 



Note that this probabihty is exponentially small in k for, 
say, m = fc/3. The following consequence of this lemma is 
proven in [Appendix A. 21 

Corollary 3. Let p be the reduced density matrix ofTii. 
The probability that measuring Ha gives the correct answer 
is at most 



2k 



+ 4,/Trn 



(5o_ffiSi_ 



To define the second decomposition, we express Tlone ~ 



0*{?o "^^^^ = for j < ^2 and 



j>t/2 



j>0 



Intuitively, all subspaces except for Rt/2 are "bad" for the 
algorithm, since they equal the "bad" 5*^,+ subspaces. Let 
TZe be the direct sum of all Rj^ ® ■ • ■ (8) Rj^ satisfying ji + 
■ ■ ■ + jk ~ £■ Then Hi = ©f^^f T?-^- This is the second 
decomposition. 

Intuitively, the algorithm can only have good success prob- 
ability if for most of the k instances, most of the input regis- 
ter sits in Rt/2- Aggregated over all k instances, this means 
that the algorithm will only work well if most of the fc-input 
register sits in TZe for £ large, meaning fairly close to kt/2. 
Our goal below is to show that this cannot happen if the 
number of queries is small. 

Let n'j = ^fJ^TZi. Note that Sm- C 7^t„/2 for ev- 
ery m: Sm- is the direct sum of subspaces 5* = Sj^^^n ® 
• • • ® 5^;. ,rfc having m minuses among ri , . . . , r-^ ; each such 
mirms-subspace sits in the corresponding Rt/2 and hence 



sen' 



tm/2 



This implies 



{So- e 5i- 



>(m-l)- 



m/2- 



Accordingly, if we prove an upper bound on Trn^j' pT, 

tm/2 

where T is the total number of queries, this bound together 
with [Corollary 3| implies an upper bound on the success 
probability of .4. To bound TrllT^/ pr, we consider the 

tm/2 

following potential function 

tk/2 

where q = 1 + j. Then for every d 

Trn^, < = P(pd)e-(i+°(i»™''^ (1) 

tm/2 

P{po) = 1, because the initial state \tpo} is a tensor prod- 
uct of the states \tpone) on each copy of Hone and \^one) 
belongs to 50,+ , hence lipo) belongs to TZo- In [Appendix A. 41 
we prove 

Lemma 4. There is a constant C such that 



tn 



l) + ^(g-l))P(p,). 



Since q — 1 + 4- . ILemma 41 means that P(pj+i) < (1 -I- 
^)P(p,) and Pip,) < (1 + < e^^^/^. By equa- 

tion|(l)| for the final state after T queries we have 



TrHi: 



pT < e 



2CT/ Vtn-{l + o{l))m./2 



We take m = fc/3. Then if T < m\rtn/8C, this expression 
is exponentially small in k. Together with [Corollary 3] this 
implies the theorem. 

4. DIRECT PRODUCT THEOREM FOR 
THRESHOLD FUNCTIONS (1-SIDED) 

The previous section used the adversary method to prove 
a direct product theorem for 2-sided error algorithms com- 
puting k instances of some symmetric function. In this sec- 
tion we use the polynomial method to obtain stronger direct 
product theorems for 1-sided error algorithms for threshold 
functions. An algorithm for has 1-sided error if the I's 
in its fe-bit output vector are always correct. 

Our use of polynomials is a relatively small extension of 
the argument in .20. . We use three results about polynomi- 
als, also used in |12l I2U| . The first is by Coppersmith and 
Rivlin 1141 p. 980] and gives a general bound for polynomials 
bounded by 1 at integer points: 



Theorem 5 (Coppersmith & Rivlin |^). Every 
nomial p of degree d < n that has absolute value 

ip(*)l ^ 1 for all integers i £ [0,n], 



satisfies 



x)\ < ae'"' for all real x € [0,n], 



where a,b > are universal constants (no explicit values for 
a and b are given in \14i )- 

The other two results concern the Chebyshev polynomials 
Td, defined as in |?7|: 

Tdix) = i (^(^x + Vx'^ - + [x ^ ^x^ ^ . 

Td has degree d and its absolute value \Td{x)\ is bounded by 
1 if a; £ [—1, 1]. On the interval [1, oo), Td exceeds all others 
polynomials with those two properties ( 1271 p. 108] and [251 
Fact 2]): 

Theorem 6. If q is a polynomial of degree d such that 
llix)] < 1 for all X £ [—1,1] then \q{x)\ < |Td(a::)| for all 
x> 1. 



Lemma 7 (Paturi USD- Td{l+p) < e^Va^-t-M^ f^r all 
/i > 0. 



Proof. For a; = 1 + p: Td{x) < {x + \/ x ^ - if = (1 + 
P+V2p + p^'f < (1 + 2^2p + ix^f < e2dV2M+M^ □ 

The following lemma is key. It analyzes polynomials that 
are on the first m integer points, and that significantly 
"jump" a bit later. 



Lemma 8. Suppose E, N, m are integers satisfying 10 < 

AT 

2m ' 



E < : md let p be a degree-D polynomial such that 



p{i) — for all i G {0, . . . ,m — 1}, 
p(8m) — a, 

p{i) G [0,1] for allie{id,...,N}. 

Then a < 2°'^°^ 

Proof. Divide p by Yl^LTQ^ix — j) to obtain 

m — 1 

p{x) = q{x) Yl {x-j), 

where d — deg(g) — D — m. This implies the following about 
the values of the polynomial q: 

k(8m)i > cr/(8m)'", 

k(*)l < l)"!)" ior i£{Em,...,N}. 

ITheorem 51 implies that there are constants a, 6 > such 
that 



bd^ /{N-Em) 



{{E- l)m)'" 

for all real x G [Em, N]. 



= B 



We now divide g by B to normalize it, and rescale the in- 
terval [Em,N] to [1, —1] to get a degree-d polynomial t sat- 
isfying 

\t{x)\ < 1 for all X G [-1, 1], 
t{l + n) = q{8m)/B ior ^j. = 2{E ~S)m/{N - Em). 

Since t cannot grow faster than the degree-d Chebyshev 
polynomial, ITheorem 61 and ILemmaTI imply 



Combining our upper and lower bounds on t{l + /i) gives 
. ((g- l)m)"' o{d^Sw^) 



which implies the lemma. □ 



Theorem 9. There exists a > such that for every thresh- 
old function Tt and positive integer k: Every 1-sided error 
quantum algorithm with T < akQ2{Tt) queries for comput- 
ing Tj-''^ has success probability a < 2""''°'' . 

Proof. We assume without loss of generality that t < 
n/20, the other cases can easily be reduced to this. We know 
that Q2{Tt) = 0{Vtn) |H1- Consider a quantum algorithm 
A with T < ak\/tn queries that computes with success 
probability a. Roughly speaking, we use A to solve one big 
threshold problem on the total input, and then invoke the 
polynomial lemma to upper bound the success probability. 

Define a new quantum algorithm B on an input j: of TV = 
kn bits, as follows: B runs ^4 on a random permutation n{x), 
and then outputs 1 iff the fc-bit output vector has at least 
k/2 ones. 

Let m — kt/2. Note that if |x| < m, then B always 
outputs because the 1-sided error output vector must have 
fewer than k/2 ones. Now suppose \x\ — 8m — Akt. Call an 
n-bit input block "full" if ■k{x) contains at least t ones in that 
block. Let F be the random variable counting how many of 
the k blocks are full. We claim that Pr[F > k/2] > 1/9. 
To prove this, observe that the number B of ones in one 
fixed block is a random variable distributed according to 



a hypergeometric distribution {Akt balls into N boxes, n 
of which count as success) with expectation fj. = 4t and 
variance V < At. Using Chebyshev's inequality we bound 
the probability that this block is not full: 

Pr[B < i] < Pr[lB - ^1 > 3t] < Pr[lB - ^t] > (3V?/2)v^] 



(3^^/2)2 " 9' 

Hence the probability that the block is full [B > t) is at 
least 5/9. This is true for each of the k blocks, so using 
linearity of expectation we have 

5A- k 
Y < Exp[F] < Pr[F > k/2] ■ k + {1 - Pr[F > k/2]) ■ -. 

This implies Pr[F > k/2] > 1/9, as claimed. But then on 
all inputs with — 8m, B outputs 1 with probability at 
least a/9. 

Algorithm B uses ak^/tn queries. By [5| and symmetriza- 
tion, _B's acceptance probability is a single- variate polyno- 
mial p of degree D < 2ak\/tn such that 

p{i) = for alH G {0, . . . , m - 1}, 
p(8m) > a/9, 

p{i) G [0,1] for aU i G {0, . . . , A^}. 



The result now follows by applying ILemma' Jlwith N = 
kn, m = kt/2, E = 10, and a a sufficiently small positive 
constant. □ 

5. TIME-SPACE TRADEOFF FOR 

SYSTEMS OF LINEAR INEQUALITIES 

Let A be a fixed N x N matrix of nonnegative integers 
and let x,b be two input vectors of N nonnegative integers 
smaller or equal to t. A matrix-vector product with upper 
bound, denoted hy y — {Ax)<:i,, is a vector y such that 
yi — mm{{Ax)[i],bi). An evaluation of a system of linear 
inequalities Ax > b is the A'^-bit vector of the truth values 
of the individual inequalities. Here we present a quantum 
algorithm for matrix-vector product with upper bound that 
satisfies time-space tradeoff T^S = 0{tN'-^ (log N)^). We 
then use our direct product theorems to show this is close 
to optimal. 

5.1 Upper bound 

It is easy to prove that matrix-vector products with up- 
per bound t can be computed by a classical algorithm with 
TS = 0{N^\ogt), as follows. Let S" = S/logt and divide 
the matrix A into {N/S')^ blocks of size S" x S" each. The 
output vector is evaluated row-wise as follows: (1) Clear 
S' counters, one for each row, and read bi. (2) For each 
block, read 5*' input variables, multiply them by the corre- 
sponding submatrix of A, and update the counters, but do 
not let them grow larger than bi. (3) Output the counters. 
The space used is 0(5*' log i) — 0{S) and the total query 



complexity is T = 0{-§t 



■ S") = 0{N^logt/S). 



The quantum algorithm Bounded Matrix Product works 
in a similar way and it is outlined in ITableTl We compute 
the matrix product in groups of S' — S/ log N rows, read 
input variables, and update the counters accordingly. The 
advantage over the classical algorithm is that we use the 
faster quantum search and quantum counting for finding 
non-zero entries. 



Bounded Matrix Product (fixed matrix Anxn, thresh- 
old t, input vectors x and b of length A'^) 
returns output vector y = {Ax)<b'- 

• For i = 1,2, . . . , 1^, where S' = S/logJV: 

1. Run Small Matrix Product on the i-th block 
of S' rows of A. 

2. Output the S' obtained results for those rows. 

Small Matrix Product (fixed As'xn, input xnxi and 
bs'xi) returns ys'xi = {Ax)<b: 

1. Initialize y := (0, 0, ... , 0), p := 1, U := {1, . . . , S'}, 
and read b. Let aixjv denote an on-line computed row- 
vector with (ij = 1 if j4[m, j'] = 1 for some u € U, and 

Oj = otherwise. 

2. While p< N and / 0, do the following: 

(a) Let Cp,fe denote an estimate of the scalar product 

P+k-l 

Initialize k = S' . First, while p + k — 1 < N and 
Cp.k < S' , double k. Second, find by binary search 
the maximal i £ [|, fe] such that p + ^ — 1 < A'' 
and Cp^e < 2S' . 

(b) Use quantum search to find the set J of all posi- 
tions j £ \p,p + £ — 1] such that ajXj > 0. 

(c) For all j € J, read Xj , and then do the following 
for all u € U: 

• Increase yu by A[u,j]xj. 

• If 3/u > 6ti, set y„ := bu and remove u from 
U. 

(d) Increase p by I. 

3. Return y. 

Table 1: Algorithm Bounded Matrix Product 

The u-th row is called open if its counter hasn't yet reached 
hu- The subroutine Small Matrix Product maintains a 
set of open rows U C {1, . . . , S'} and counters < j/„ < 6u 
for all u £ U. We process the input x in blocks, each con- 
taining between S' - O^^/W) and 25" -|- 0{VS') non-zero 
numbers at the positions j where A[u, j] ^ for some u SU. 
The length i of such a block is first found by iterated quan- 
tum counting (with number of queries specified in the proof 
below) and the non-zero input numbers are then found by a 
Grover search. For each such number, we update all coun- 
ters yu and close all rows that exceeded their threshold bu- 

Theorem 10. Bounded Matrix Product has bounded 
error probability, its space complexity is 0{S), and its query 
complexity is T = 0{N^''^Vt ■ {logNf^/s/S). 

Proof. The space complexity of Small Matrix Prod- 
uct is 0{S' log N) = 0{S), because it stores a subset U C 
{1, . . . , 5 }, integer vectors y, b of length S with rmmbers at 
most t < N, the set J of size 0(S") with numbers at most 
N, and a few counters. Let us compute its query complexity. 



Consider the t-th block found by Small Matrix Prod- 
uct; let Pi be its left column, let ii be its length, and let 
Ui be the set of open rows at the beginning of processing of 
this block. The scalar product Cj,^/^ is estimated by quan- 
tum counting with M = \/£^ queries. Finding a proper £i 
requires 0{log£i) iterations. Let be the number of rows 
closed during processing of this block and let Si be the total 
number added to the counters for other (still open) rows in 
this block. The numbers £i,ri,Si are random variables. If 
we instantiate them at the end of the quantum subroutine, 
the following inequalities hold: 

^ £i < TV, ^ ri < S', and J^SiK tS' . 

i i i 

The iterated Grover search finds ones for two purposes: clos- 
ing rows and increasing counters. Since each bi < t, the 
total cost in the i-th block is at most X)5^=i + 

EjLi 0{^/7~/j) = 0{^/£ir,t+^/li7',). By a Cauchy-Schwarz 
inequality, the total number of queries that Small Matrix 
Product spends in the Grover searches is at most 

#blocks I , I I 

X: + ^) < ijt E + wE JE 

< VNVtS' + VNVtS' = 0{VNS't). 

The error probability of the Grover searches can be made 
polynomially small in a logarithmic overhead. It remains 
to analyze the outcome and error probability of quantum 
counting. Let Ci = Cp.^e- £ [S',2S']. One quantum counting 
call with M = sfll queries gives an estimate w such that 

k-c,| = o(^y^^^^^ + |j =0(V^J=0(VS^) 

with probability at least S/tt^ ^ 0.8. We do it C>(logiV) 
times and take the median, hence we obtain an estimate c 
of Ci with accuracy 0{\fS'') with polynomially small error 
probability. The result of quantum counting is compared 
with the given threshold, that is with S' or 2S". Binary 
search for i' G costs another factor of logfc < log A''. 

By a Cauchy-Schwarz inequality, the total number of queries 
spent in the quantum counting is at most (log AT) ^ times 

E ^ ^ ^E ^'yS^ - ^V#blocks 

< \fNsJWT't < VNS't, 

because in every block the algorithm closes a row or adds 
0(S") in total to the counters. The number of closed rows is 
at most S' and the number S' can be added at most t times. 

The total query complexity of Small Matrix Product 
is thus 0{\/ NS't ■ (logA')^) and the query complexity of 
Bounded Matrix Product is N/S'-times bigger. The 
overall error probability is at most the sum of the polyno- 
mially small error probabilities of the different subroutines, 
hence it can be kept below 1/3. □ 

5.2 Lower bound 

Here we use our direct product theorems to lower-bound 
the quantity T S for T-query, S-space quantum algorithms 
for systems of linear inequalities. The lower bound even 
holds if we fix b to the all-t vector t and let A and x be 
Boolean. 



Theorem 11. Let S ^ mm{0 {N/t),o{N/ log N)). There 
exists an N X N Boolean matrix A such that every 2-sided 
error quantum algorithm that uses T queries and S qubits of 
space to decide a system Ax > t of N inequalities, satisfies 
T^S = f7(tiV^). 

Proof. The proof is a modification of Theorem 22 of 
(quant-ph version). They use the probabihstic method to 
estabUsh the foUowing 

Fact: For every k = o(N/logN), there exists an N x N 
Boolean matrix A, such that all rows of A have weight N/2k, 
and every set of k rows of A contains a set R of k/2 rows 
with the following property: each row in R contains at least 
n = N/Qk ones that occur in no other row of R. 

Fix a matrix A for k = cS, for some constant c to be cho- 
sen later. Consider a quantum circuit with T queries and 
space S that solves the problem with success probability 
at least 2/3. We "slice" the quantum circuit into disjoint 
consecutive slices, each containing Q — ol\J tNS queries, 
where a is the constant from our direct product theorem 
llTh eorem l|l . The total number of slices is L = T/Q. To- 
gether, these disjoint slices contain all A*' output gates. Our 
aim below is to show that with sufBciently small constant a 
and sufficiently large constant c, no slice can produce more 
than k outputs. This will imply that the number of slices is 
L > N/k, hence 



T ^ LQ> 



cVS 



Now consider any slice. It starts with an 5-qubit state 
that is delivered by the previous slice and depends on the 
input, then it makes Q queries and outputs some £ results 
that are jointly correct with probability at least 2/3. Sup- 
pose, by way of contradiction, that £ > k. Then there ex- 
ists a set of k rows of A such that our slice produces the 
k corresponding results (t-threshold functions) with proba- 
bility at least 2/3. By the above Fact, some set R of k/2 
of those rows has the property that each row in R contains 
a set of n = N/6k — Q{N/S) ones that do not occur in 
any of the k/2 — 1 other rows of R. By setting all other 
N — kn/2 bits of x to 0, we naturally get that our slice, 
with the appropriate 5'-qubit starting state, solves k/2 in- 
dependent f-threshold functions Tt on n bits each. (Note 
that we need t < n/2 — 0{N/S); this follows from our as- 
sumption S = 0{N/t) with appropriately small constant in 
the 0(-).) Now we replace the initial S-qubit state by the 
completely mixed state, which has "overlap" 2~'^ with ev- 
ery S-qubit state. This turns the slice into a stand-alone 
algorithm solving y/*''^' with success probability 

- 3 



But this algorithm uses only Q — a^/tNS = 0{ak\/tn) 
queries, so our direct product theorem (ITheorem 111 with 
sufficiently small constant a implies 



a <2 



= 2 



-n{cS/2) 



Choosing c a sufficiently large constant (independent of this 
specific slice), our upper and lower bounds on a contradict. 
Hence the slice must produce fewer than k outputs. □ 

It is easy to see that the case S > N/t (equivalently, 
t > N/S) is at least as hard as the S = N/t case, for which 



we have the lower bound T'^S = Q,{tN^) = n(Ar'*/S), hence 
TS = Q{N^). But that lower bound matches the classical 
deterministic upper bound up to a logarithmic factor and 
hence is essentially tight also for quantum. We thus have 
two different regimes for space: for small space, a quantum 
computer is faster than a classical one in solving systems of 
linear inequalities, while for large space it is not. 

A similar slicing proof using iTh eorem 9l (with each slice 
of Q = a\/ NS queries producing at most S/t outputs) gives 
the following lower bound on time-space tradeoffs for 1-sided 
error algorithms. 

Theorem 12. Let t < S < mm{0{N/t'^),o{N/\ogN)). 
There exists an N x N Boolean matrix A such that every 
1 -sided error quantum algorithm that uses T queries and S 
qubits of space to decide a system Ax > t of N inequalities, 
satisfies T^S = Q.{t^N^). 

Note that our lower bound fl{t^N'^) for 1-sided error algo- 
rithms is higher by a factor of t than the best upper bounds 
for 2-sided error algorithms. This lower bound is proba- 
bly not optimal. If 5 > N/t'^ then the essentially optimal 
classical tradeoff TS — Q,{N^) takes over. 

6. SUMMARY 

In this paper we described a new version of the adversary 
method for quantum query lower bounds, based on analyz- 
ing the eigenspace structure of the problem we want to lower 
bound. We proved two new quantum direct product theo- 
rems, the first using the new adversary method, the second 
using the polynomial method: 

• For every symmetric function /, every 2-sided error 
quantum algorithm for using fewer than akQ2{f) 
queries has success probability at most 2~^'*'. 

• For every f-threshold function /, every 1-sided error 
quantum algorithm for /''°' using fewer than akQ2{f ) 
queries has success probability at most 2"^'*''. 

Both results are tight up to constant factors. From these re- 
sults we derived the following time-space tradeoffs for quan- 
tum algorithms that decide a system Ax > b of N linear 
inequalities (where A is a fixed N x N matrix of nonnega- 
tive integers, x, b are variable, and < t for all i): 

• Every T-query, S-space 2-sided error quantum algo- 
rithm for evaluating Ax > b satisfies T^S — Q,{tN'^) 
if 5 < N/t, and satisfies TS = n{N^) if S > N/t. 
We gave an algorithm matching these bounds up to 
poly log factors. 

• Every T-query, S-space 1-sided error quantum algo- 
rithm for evaluating Ax > b satisfies T'^S ^ Q{t^N^) if 
t< S < N/t^, and satisfies TS = Q,{N^) if S > N/t^. 
We do not have a matching algorithm in the first case 
and conjecture that this bound is not tight. 
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APPENDIX 

A. PROOFS FROM SECTION 3 
A.l Proof of Lemma 2 

The measurement of Ha decomposes the state in the TLi 
register as follows: 

P~ Ptii,...,afcO"ai,...,afc, 
ai,...,afcG{0,l} 

with Pai,...,afc being the probability of the measurement giv- 
ing the answer (ai, . . . , a^) (where aj = 1 means the algo- 
rithm outputs — not necessarily correctly — that |a;-'| =t and 
Oj — means = t — 1) and aai,...,ak being the density 
matrix of Hi, conditional on this outcome of the measure- 
ment. Since the support of p is contained in 5o- ©• • -OSm-, 
the support of the states aai,....ak is also contained in iSo- ® 



■ • ■ ® Sm- . The probability that the answer (ai , 
correct is equal to 



, Clfe) IS 



We show that, for any aai,...,af, with support contained in 

5o-®---®5„-,[(2y]isatmost ^Zl^J^, 

For brevity, we now write a instead of (Tai,...,afe. A mea- 
surement w.r.t. (Si Si^aj and its orthogonal complement 
commutes with a measurement w.r.t. the collection of sub- 
spaces 

®i=i(S'i,.o®Si^,i), 
. . . ,lk range over {0, . . . , t}. Therefore 



Sj,a — 

\i>n,.. 

Rj = 



,ij ) 

.0 



't/2 



uniform superposition of states with \x\ = t — 1 + a and with j fixed bits set to 1 

spanned by for all j'-tuples i 

that is, we remove the lower-dimensional subspace 

projection of \ipi-^^...^i.) onto Sj^a 

spanned by ^ ± ^ 

for i < I • ■ • bad subspaces 

direct sum of 5*^,+ for j > t/2, and all Sj,- . . .good subspaces 



~ ® ® where \r\ is the number of minuses in r = ri, . . . ,rk 

|r|— m i— 1 
k 

® ® Rji where \j\i is the sum of all entries in j = ji, . . . ,jk 

m 

m>j 



uniform superposition of states with |a;| = t — 1 + a, with j fixed bits set to 1, and xi = fe 
spanned by i ) for all j'-tuples i 



~ Tj a bf^ TjLi a b that is, we remove the lower-dimensional subspace 



projection of \tp°l^ j .) into Sj^a.b 



spanned by a]|^ + 



Table 2: States and subspaces used in the proof 



Hence to bound [(2)| it suffices to prove the same bound with where the second inequality uses Cauchy-Schwarz and 



instead of a. Since 



we have 



(3) 



We prove this bound for t he ca se when a' is a pure state: 
a' = \ip){tp\- Then equation [(3)] is equal to 



lin. 



j = i tj. 



(4) 



The bound for mixed states a' follows by de composing a' as 
a mixture of pure states bounding | (4) | for each of those 
states and then summing up the bounds. 
We have 



ri,...,rfcG{-t-,-}, i = l 
|{i:r^ — — }|<m 



We express 



IV") = Y ari,...,rJVri,...,rfc), 

ri,.--,rke{ + ,-}, 
{i;ri — — }|<m 

with |V'ri,...,rJ G ®%iSi^,ry Therefore 

J — J- ''J-J 



rk II I 



(5) 



ri ,...,rt 



ri ,...,rj. 



Claim 13. IIH, 



^•0 



Proof. Let |</5f [dim 5;^. ,o] form a basis for the sub- 

space S'i^^o- Defineamap(7j : Si^ ^ Si^ ,ihy Uj\i>i^^,,,^i^^) ^ 
Itpl i ). Then Uj is a multiple of a unitary transforma- 

tion: Uj = Cjiyj for some un itary Uj and a constant Cj. 
(This follows from lClaim 161 in [Appendix A.4| ) 

Let = U!i\(p{''^}. Since Uj is a unitary transforma- 

tion, the states lifii'^) form a basis for Si^.i. Therefore 



(6) 



i=i 



is a basis for ^'^^iSi-^aj- Moreover, the states 

are a basis for 5';^,+ and Sij,-, respectively. Therefore 

k 



\^r„....r,)= «n....,«.(8)l<^). (7) 

j = l 

The inner product between (8)*Li|(^^,'''^ ) and (^']^i\ipl'^^) is 



Note that rj G { + ,— } and Oj G {0, 1}. The terms in this 
product are if i'j — ij and otherwise. This means that 



®j^i\ipl'^') has inner product ±^7772- with ®*Li|(^^'°^) and 
inner product with all other basis states [(6)1 Therefore, 

1 



Together with equation |( 7) | this means that 

1 1 

Squaring both sides completes the proof of the claim. □ 

Since there are (^,) tuples (n, . . . , r^) with n, . . . ,rk G 
{+, — } and \\i : Vi — — }| = m'. IClaim 131 together with 
equation |(5)| implies 



lin^-e 



.^11' < 



Em { ^ \ 

m'=0 \m') 
2k 



A.2 Proof of Corollary 3 

Let \ip) be a purification of p in Ha ® Ti.!- Let 



where j?/)') is in the subspace Ha ® {So- ©5i- 
and ji/j") is in the subspace Ti.A ® (5o- © 5i_ Q 
Then 5 = TrH, 



■•©5m-) 
©5m-)^. 

The success probability of A is the probability that, if we 
measure both the register TCa containing the result of the 
computation and Hi, then we get ai, . . . , and , . . . 
such that contains t—l + aj ones for every j £ {1, . . . , k} . 

Consider the probability of getting ai, . . . ,ak G {0, 1} and 
a;^, . . . , a;* € {0, 1}" with this property, when measuring lip') 
(instead of lip)). Bv ILemma 21 this probability is at most 

^"'=2^"'^ We have 

liV' - V-'ll < (1 - VT~5)\\tP'\\ + VsW'W 
= (1 - Vl - 5) + V5< 2V5. 

We now apply 

Lemma 14 (0). For any states \tp) and j-i/;') and any 
measurement M , the variational distance between the prob- 
ability distributions obtained by applying M to and 
is at most 2\\%l) — ijj'W. 



Hence the success probability of A is at most 
^+4^/5 = +4./Trn 



Em ( k \ v~^m / k 

m' —0 VmV I /J ^m'— \m' 



(So-e- 



2k 2^ 

A.3 Structure of the subspaces when asking 
one query 

Let \ilid) be the state of Ha ® Hi after d queries. Write 

i=0 

with IV'd.i) being the part in which the query register con- 
tains Let = Trn^ Then 



1=0 



(8) 



Because of 



we have P{pd) = X]i°=o '^lP{pd,i)- Let pjj be the state after 
the d-th query and let = X^^Tn o -iPd.i be a decomposition 
similar to equation |(8)| ILemma 41 follows by showing 

Pip'd,) <(l + ^(?'/' - 1) + ^{q - 1)) P{Pd,.) (9) 
V Vtn Vn / 



for each i. For i — 0, the query does not change the state 
if the query register contains \i). Therefore, p'^ p ~ Pd,o and 
P{p'd,o) ~ P{Pd,o)- This means that equation 1(9)] is true for 
i = 0. To prove the i G {1, . . . , kn} case, it suffices to prove 
the i — 1 case (because of symmetry). 

Let (with a,b e {0, 1} and ii,...,ij £ {2, . . . , n}) 

be the uniform superposition over basis states \h,X2, ■ ■ ■ , Xn) 
(of Hone) with b + X2 + ■ ■ ■ + Xn = t — 1 + a and Xi-^ = 
■ ■ ■ = Xi- — 1. Let Tj^a.b be the space spanned by all states 
K''....,/) and let 5,,.,, = r,..,5 n Let = 

J — 1 ,a, b ^ ' 'J 
jC<,/3 



Let 5";^ be the subspace spanned by all states 

7a, 



zj^ , . . . ,Zj 1 1 II ,.. I 



(10) 



Claim 15. Let Oa 



(t-l + a)-j \\J.a,l 
n — j 



-(t-l + g) II 7°. I 



and (5a 



UZl.,^^\■ Then (i) Sll'>'^ C S,,a and (ti) 



Proof. For part (i), consider the states I'i/'i" . ) in Tj,a, 
for 1 ^ { ii , . . . , ij } . We have 



+ 



In- 




-1 + a) 




n 


- 3 




1 ^ 





n - J 



,) (11) 



because among the states Ixi . . . Xn) with jxj = f — 1 + a 



and Xi^ = ■ ■ ■ = Xi. ^ 1, 



n — (t — l + n) 



fraction have X\ = Q 



and the rest have x\ — 1. The projections of these states to 

Tj-i^a,o n Tj-i,o,i are 



n-(i-l+a)j^^o 



n - J 



(f - 1 + a) - J 



n - J 



which, by equation llUl are exactly the states spanning 
S""'*^". Furthermore, we claim that 

Tj-l,a C Tj-l^a,0 ©7j-l,ci,l C Tj,a. (12) 

The first containment is true because Tj-i^a is spanned by 
the states _ ^ ) which either belong to Tj-2,a,i C 

2i_i,a,i (if 1 € {ii, . . . , ij-i}) or are a linear combination of 
staXes \ij)°(^ ^. ^) a,nd\ij)^^ \ (bv equation pn). which 
belong to Tj_i,a,o and Tj-\^a,\- The second containment fol- 
lows because the states spanning Tj-\,a,i are the 
same as the states IV'i.ii ) which belong to Tj^a, and 
the states IV'f^'" i _j) spanning Tj-\^a,o can be expressed as 
linear combinations of and which 
both belong to Tj,a. 

The first part of 1121 1 now implies 



Also, S""^ C Tj,a, because S"^ is spanned by the states duces to 



J — l,a,0 J — l,a,l 

and belongs to Tj^a by the definition of Tj^a and 

nTj_i_„,o®Tj-i,„,il'/','\,...,ij.) belongs to Tj^a because of the 
second part of lO. Therefore, 5'^'^;;'''° C Tj,ar\T^_i^^ = Sj,a- 
For part (ii), we have 

g.aa,/3o g^^^ g Sj^a.l C Tj,a,0 ffi Tj^a,l C Tj + l,a, 

where the first containment is true because 5'"^'''" is spanned 
by linear combinations of vectors li/""^'" j .) (which belong 

to Sj,a,o) and vectors IV'fj^...^^^ ) (which belong to Sj,a,i) and 
the last containment is true because of the second part of 
equation l)12|l . Now let 



E (C;,....,^_,.'l^> = 0. (16) 

By symmetry, the inner products in this sum are the same 
for every i' . Hence they are all 0, in particular for i' = ij- □ 

A.4 Proof of Lemma 4 

Claim 16. The maps Uoi : Sj,o,o Sj,o,i, Uio ■ 5j,o,o 
5^,1,0 and Uii : 5^,0,0 5j,i,i defined by Uab\i>il°,,,^i.} = 
IV'^i'* i ) '^''^ multiples of unitary transformations: Uab = 
CabU^ij for some unitary [/^j, anci some constant Cab- 

Proof. We define M : r,,o.o Tj,o,i by 

M\0x2-.-Xn)= E 1112 • . • Kf-iOi^+i . . . a;„). 



(13) 



be one of the vectors spanning S^j"^' To prove that \tp) 

is in Sj+i,a = 7j+i,a H T^l^j, it remains to prove that [ip) is 

orthogonal to Tj^a- This is equivalent to proving that \tp) 

is orthogonal to each of the vectors \M ., ) spanning Tj,a. 

II---- j 

We distinguish two cases (note that 1 ^ {ii, . . . , ij}): 
Case 1. 1 G {j'l, . . .,i'j}. 

For simplicity, assume 1 = i' . Then j?/;"/ ^/ ) is the same 

as I?/)",' ., ), which belongs to Tj-i^a,i- By definition, 
the vector Ii/;) belongs to Tj^i^a.o 7j^i,a,i a-nd is therefore 
orthogonal to IV'^''^ i' )• 
Case 2. 1 ^ {i'l , . . . , i^}. 



We will prove this case by induction on £ = \ {i'i , . . . , i'j} - 



{ii, 



In the base step {£ — 0), we have {i'l, . . . ,ij} = {i\, . . . ,ij}. 
Since \ip) belongs to T/li^^.o ^ ^Ai.a.ii it suffices to prove 

is orthogonal to the projection of |V'?i ,...,1^ ) to T^^i j, g 
7j^i,a,i which, by the discussion after equation IllH . equals 



7a, 1 



(14) 



From equations 1131 and (I14II , we see that the inner product 
of the two states is aa/3a — PaOLa ~ 0. 

For the inductive step {£ > 1), assume i'j ^ {ii, . . . ,ij}. 
Up to renormalization, we have 



t fflil-, , . . . ,1 . 



Because ., ) is in Tj-i^a.o ® T)-i,a,i, we have 

J - 1 



Note that M does not depend on j. We claim 

^K'!...,,> = ciC--..)' 
Mt|v;°;!....J = c'iC-.,)' 



(17) 



for some constants c and c' that may depend on n,t and j 
but not on ii, . . . , ij . To prove that, we need to prove two 
things. First, we claim that 

A^K°..,.,)=c|C..,^.) + i^'), 



(18) 



wherek/)') £ Tj-i.o,! (note that 1 ^ {ii, . . . , ij}). Equa- 
tion 1(18)] follows by 



'n-j-l\ 



I I — t — Ij^i — 
x j, — ■ ■■ — Xi . — 1 , 



- f + 1 



E E lla;2 . . • a;f-iOa;f+i . . . a;„) 



x:\x\=t-\,xi=0 = \ 
X,- , — - - -—a;,- . —1 



E 



+ , ^ E E I 

y(t_l_J f=l H:|!/Ni-l,Hl = l,!/,j=0 

"-/^^' + ^ E ly> 

+^^E E 1?^) 

(t_l_^J f=l i;:ly|=t-l,i;i=l 



E (V'^-.^.,yl^)-(^^-.._J^)-0. (15) ^ (n-t-; + l),/^-^-^|<^ 



As proven in the previous case, {?/)''/ ■/ , |?/>) = 0. More- 

1 ' ■ ■ ■ ' J - 1 ' 

over, by the induction hypothesis we have (■!/;"/ -/ -,\'\p) = 
whenever i! £ {ii, . . . ,ij}. Therefore equation 1151 re- This proves 1181 . with \ip') equal to the second term. 



n- J 
n-t + 



lEiC- 



Second, for every j, M{Tjfi,o) C Tjfi,i and M{Tj^o^a) C 



2j,o,i- The first statement follows from equation H18|l . be- 
cause the subspaces Tj^fi, Tj^^i are spanned by the states 
and respectively, and r,-i,o,i C Tj,o,i- 

To prove the second statement, let \ip) G 7j!b,0i 1^) = 
J2x°-^\^)- We would like to prove M|?/)) G Tj^o.i- This is 
equivalent to {tp^^^ ^ . |M|?/)) = for all ii, . . . , ij. We have 



E 



'n — j — l\ 

!/-l!/l=t-l.Hl = l 



1 



E 



E 



E 



= 0. 



Xi , — ■ ■ ■— a:,- . —1 



The first equality follows by writing out (1/)^^ ^ . | , the sec- 
ond equality follows by writing out M . The third equality 
follows because, for every x with = t~l and Xi-^ = . . . = 
Xi- = 1, there are t — 1 — j more I G [n] satisfying a;^ = 1. 
The fourth equality follows because ^ x:|x|=t-i,xi=o ax is a 

x,^=...=x,^=l 

constant times {ijif,,,,^i.\'4') , and (V'i'i" ■ IV') — because 



To deduce equation |(17)| we write 
Since M(Tj_i,o,o) C rj-1,0,1 and M(T,^i,o,o) ^ r/_i,o,i, 

with the second equality following from HSU and G 
rj_i_o,i- This proves the first half of |(17)| The second half 
follows similarly. Therefore 

Hen ce M is a multiple of a unitary transformation. By equa- 
tion [^T)] Uoi = M/c and, therefore, C/qi is also a multiple 
of a unitary transformation. 

Next, we define M by M\Qx2 . . . a;„) = 1 1x2 . . . x^) . Then 
M is a unitary transformation from the space spanned by 
\Qx2 ■ ■ ■ Xn), a;2 -I- • • • -I- a;2 = t — 1, to the space spanned by 
1 1x2 ■ ■ ■ Xn) , 1 -\- X2 + ■ ■ ■ + Xn = t. Wc claim that f/11 = M. 
To prove that, we first observe that 



'n — j — l 



J2 M\0X2...Xn) 



Xj, — ■ ■ - — Xj . —1 



'n-j-l\ 
U-j-l) 



E \'^^2...Xn) ^\tpjll„^i^}. 



Since Tj,a,b is defined as the subspace spanned by all 1 1/'^^'*' -,), 
this means that M{Tjfifi) = Tj^i^i and similarly M(Tj_i,o,o) ~ 
Tj-i,!,!. Since M is unitary, this implies M(Tj'ii o,o) = 



Tj_i i i and 

Finally, we have Uio ~ U"qUii, where C/"q is defined by 
Uio\''Pil]...,ij} = \''Pif,....ij)- Since Un is unitary, it suffices to 
prove that C/"o is a multiple of a unitary transformation and 
this follows similarly to Uoi being a multiple of a unitary 
transformation. □ 

Let \ipoo) be an arbitrary state in 5^,0,0 for some j G 
{0,...,t-l}. Define \^ab) = K^l^oo) for ab G {01, 10, 11}. 
Let 1 1/)2 ),..., IV'fc) be vectors from subspaces Rj^ , ■ ■ ■ , Rj^ , 
for some j2, ■ ■ ■ ,jk- We first analyze the case when pd,! be- 
longs to the subspace Ti.4 spanned by jV'af))® IV'a)®' ■ 



= 

eta = 



Clai m 17. Let 

n-(t-l + a) II J.g.O 



(t-l + a)-j \\ 7.a,l II 



1. i^i) = aoji/'oo) +/?o!V'oi) + Qii-iAio) + belongs to 

2. 102) = /3o|'/'oo) - aolV'oi) +/?ii'/'io) - ail'/'ii) belongs to 

5. ^ny linear combination of \tpoo), I'tpoi) , |i/'io) and jV'ii) 
which is orthogonal to j^i) and |(;/>2) belongs to S- = 
® j=o 'S'i,- • 

Proof. Let ii, . . . ,ij he j distinct elements of {2, . . . , n}. 
As shown in the beginning of the proof of lClaim 151 



\i>ti,...,ij) 



n - (t-l + a) ja.o > 



J 



This means that = + (/^a)^ and 

Since the states I'i/'i'j . ) span 5*^,0, the state [ipoo) is a 
linear combination of states -\l'u '^^ ■ Bv IClaim 161 the 



states li^ab) are linear combinations of 



with the 



same coefficients. Therefore, |cj!>i) is a linear combination of 
"OT^TTH u+Po-joj -l-Qii-^y-n ;7+A: 



li'n,...,.,) I^n. 
T-^^:^ — H ^ 



each of which, by definition, belongs to 5-,,+ . 



Let ii, . . . ,ij be distinct elements of {2, . . . ,n}. We claim 



w,n,...,.,) , Wit...;) _ \€t..,^; 



IIV'?. 



tl,...,tj 



II lie 



(19) 



Bv lClaim 151 the right hand side of |(19)| belongs to Sj+i.a- 
We need to show that it is equal to |^/'i,ii,...,ij)- We have 

IV'S'.ii,. ..,,:,) = ^Tl-J'^l,ii,....ij) = ^Tf^Wt...i; 

where the third equality follows from Tj_i,a,i C Tj^a- This 
is because the states lip^^ ^) spanning Tj_i,a,i are the 
same as the states |'!/'i,ii,...,i^_i) in Tj,a. Write 



where 



IC;...,i,)=Ci|5i)+C2|52) 



1^2)= A 



l,...,ijl 11^' ijl 

ICl'°...,i,) ICi'^.,i,) 



'IK',...., I 



I1C'°...,II 



Bv lClaim ISl we have \5x) G Sj,a C Tj^a, 152) G Sj+i,a Q 
T^^. Therefore, nyj_j7/>";^ _-^) = C2\52} and 

= ]02) = Pa 



11,..., Ij I 



11^; 



a,0 I 
, . . . ,Zj I 



IIV'. 



S 1(19)1 

larly tc 



provmg I 

Similarly to the argument for |<^i), equation |(19)| implies 
that |(j!)2) is a linear combination of 



li'Z...; \^'t..,) \^lt..^; 

^°iiei.,ji "°iie:...,ji''^Nie°...,ji "'iie:...,ji 



Il< 



+ 



and each of those states belongs to . 

To prove the third part of lClaim 171 we observe that any 
vector orthogonal to \(f)i) and |(j!)2) is a linear combination of 

103) = ao\ipoo) + /3o|V'oi) — ailV'io) — /3i|V'ii), 
which, in turn, is a linear combination of vectors 



IK,...,,, II IIV^!i,.....JI 



and 



\(l)4) = /3o|'i/'oo) - aol'i/'oi) - /3i|i/'io) + QilV'ii) 
which is a linear combination of vectors 

K2^^_ K^^^ 

ii<H,. II iiKn,...,,jr 

This means that we have \(j>3) G Sj,- and 104) G Sj+i,-. □ 



Claim 18. Let j < t/2 and xl- = x{x — I) ■ ■ ■ {x — j + I). 



1- U 



a.b 



{n-t-a + b)i 



(n - j)2 



2- iiv;:v"...ji>;7fii'^n'...,i 



IIV'. 



1,1 



1,0 



l + O 



II V^i 1 , . . . ,Zj 1 1 1 1 , . . . .ij I 

Proof. Define ia = t — 1 + a. We calculate the vector 

W;'...,,; -'nT|-_,^^ Ji^nl.,^,)■ 

Both vector IV'^j' i ) and subspace Tj-i^a.b are fixed by 
UttIx) = !a;^(i) . . .x^(^ri)) 

for any permutation tt that fixes 1 and maps 

to itself. Hence ^.) is fixed by any such f/^ as well. 

Therefore, the amplitude of |a;) with \x\ = ta, xi — b in 



21 , . . . ,1 

a, 6 



. ) only depends on , . . . , ij} n {i : Xi — l}j. 



I'^/'fi i ) is of the form 

i 

jWa.t) = ft. 



E 

|{il,...,ij}n{i:xi-l}|-ji 



1^)- 



To simplify the following calculations, we multiply no, ■ ■ ■ , Hj 
by the same constant so that Kj — 1/y Then 
\'4'lt i.) remains a multiple of \va,b) but may no longer be 
equal to \va,b)- 

Ko, ■ ■ ■ , ttj-i should be such that the state is orthogonal to 
Tj-i,a,b and, in particular, orthogonal to the states |?/>"^' 
for all £ G {0, ... ,j - 1}. By writing out {va,bWt...,i; ^ 

n-j-1 \ ( j - e 



ta ^ Tn — b j \m 



= 0. 



(20) 



To show that, we first note that ) is a uniform super- 

position of all |a;) with |a;| — ta, xi = b, Xi^ = ■ ■ ■ = Xi^ = 1. 
If we want to choose x subject to those constraints and also 
satisfying . . . C] {i : Xi — 1}\ — m, then we have 
to set Xi — 1 for m ~ £ different i G {ii+i, . . . and for 



ta — m — b different i ^ {1, i\, 



,}. This can be done in 



and different ways, respectively. 

By solving the system of equations II2UL starting from 
I = j — 1 and going down to ^ = 0, we get that the only 
solution is 



Km = (-1)' 



Let jfa.b) = |'|^°'^|| be the normalized version of \va,b)- 
Then 

IC'''...,i,) = K,blV'r;!'....i,)l"l,6), 



ln-j-l\ 
j — m \ta—j — b/ 



( n-j-1 N "^J- 
\ta-m-b) 



(21) 



1-1, 

7a, 6 



/ I / a,b 



II ;a,0 II / / I ia,D \ {^^a,i'IV'ii,...,ij) , , 

11^',...,,, II = {Va,bW; i,) = ii^^^^ii ■ (22) 



We have 



{Ua,b\i>tt...^i.) = 1, 



because {ip!^^^ j.) consists of ( " basis states \x), xi 



b, Xi^ — . . . — Xi. — 1, each having amphtude Vy (" -j-fc) 
in both \va,b) and \'4'i^ i )- Furthermore, 



\\Va,hf = 

m — i 
3 

= E 

m — i 
3 

= E 

m — i 
3 

= E 

m — i 
3 

= E 



1 1 2 

ta — m — I 



Ua-j-b^ 2 
/ n-j-1 \ '^J 
\t„-m-6/ 

/n-j-l\ 

Vt„-j-6; 
/ n-j-1 \ 
\ta—m — b) 

(tg-m- b)!(n -tg+m-j -1 + by. 

{tg~ j ~by.{n-tg-i + by. 



(n^tg-l + b)i^ 



(23) 



Here the first equaUty foUows because there are (^) 
vectors x such that = tg, xi — b, Xi = 1 for m different 
i G {ii, . . . , ij} and tg — m different i ^ {f , ii, . . . , ij}, the 
second equahty follows from equation 12H and the third 

equality follows from our choice Kj — 1/ \J {"^jlX) ■ 

From equations [(22)] and [(23)] \\i>t;l..,i^\\ = where 

Ag^b = J2m=o Ca,b{m) and 



ml (n-ta-l + by- 



The terms with m > j are zero because (^) — for m > j. 

We compute the combinatorial sum Ag,b using hypergeo- 
metric series Section 5.5]. Since 

Ca,i,(m + f ) _ {m - j){m + n - ta - j + b) 



Ca,b{m) 



{m + l){m - ta + b) 



is a rational function of m, Ag^ is a hypergeometric series 
and its value is 



Ag,b = 5Z c;^Am) = c„,5(o) ■ F 



-j, n-tg- j + b\ 

-tg+b I 



We apply Vandermonde's convolution F{ "'^ ^|1) = {x — 

y)^/{—y)^ El Equation 5.93 on page 212], which holds for 
every integer j > 0, and obtain 



AgJ 



{tg - by- 



(n - j)l 



(n - iY 



{n-tg-l+b)L {tg-b)L (n-tg-l + b)l 



This proves the first part of the claim, that ||^! 

^{n-tg-l + by-/{n-jy-. 

The second part of the claim follows because 



a.b 



{n-tg- ly- 

[n - tg)l 



n — tg—j 
n — tg 



= ^ l- 



J 



n — tg 

because j < tg/2, and tg < n/2. 



1 - 



n/4 _ 1 



For the third part, 
Ai,oAo,i 



i{n-ty-)' 



Ao,o^i,i (n - t + l)l{n -t-l)l 
^ {n-t){n-t-j + l) 
{n~t + l){n~t~j) 
j 



1 + 



{n-t + l){n-t-j)-' 



which is 1 + e>{j/n^) = 1 + 0{l/t) for t < n/2 and j < t/2. 
The expression in the third part of the claim is the square 
root of this value, hence it is 1 + 0(l/t). □ 

Claim 19. // j < t/2, then /3„ < ,/^. 



Proof. Define = i- 1 +a. Bv lClaim ISl 
. That implies 



a,0 



I — tg Jg O 

= , , h/'.i... 



^ 1 Vn-tg - j 

and hence 



\/n — tg 



Then, using j < , 

0g 



n~tg 
2(ia-i) 



, ^/n + tg- 2j 



Pa = 



^ ^2{tg - j) ^ 



^/(KyTWr ~ Vn + tg-2j 



n 



Claim 20. // j < t/2, then |qo/3i - ai/?o| = O —;= 
Proof. We first estimate 



"i/^o <Po vin~t)it-i~j) 



Bv lClaim ISl we have 



Since 



^{n-t + l){t-j) 



tJJ ^{n-t){t^ 



t-i-j 



1 + 0{ 



t-i-j' 



Vt-i-j " 

and, similarly, ^^Si = 1 + 0(;^) = 1 + 0(i), we have 
shown that Sa^L is of order 1 + 0(t)- We thus have 



!aoA-/3oa.l=o(i) lA^^I = O (^i j = O (-i= 
thanks to lClaim 191 and the fact that |ai| < 1. □ 



We pick an orthonormal basis for Ti.4 that has |<^i) and 
102) as its first two vectors. Let l^s) and 104) be the other 
two basis vectors. We define 



\xi) = \4>i) ® IV'2) ® ■ ■ ■ ® {ipk}. 



Bv lClaim 171 jxi) belongs to Sj,+ ^Rj. 



contained in TZ 



min(j,t/2)+i2 + ---+ife 



(24) 

which is 
Similarly, \x2) belongs to 



7^min(j+i,t/2)+i2+.-+jfc and Ixs), \Xi) belong to 7^i/2+J2 + ...+J^^ 
If j < t/2, this means that 



„J2 H Kifc 



(i7''{xilPd,ilxi) + g-'^^{x2lpd,ijx2) 



+9^ (xslPd.ilXs) + {X4lPd,ilX4) 



(25) 



If J > i/2, then |xi), jX2), Ixa), 1X4) are all in 7^t/2+J2 + ...+JV 
This means that P{pd.i) ~ g'/^^^^^ and it remains 

unchanged by a query. 

We define -yi = {xAPdAxe) ■ Since the support of is 
contained in the subspace spanned by \xe) , we have 71 + 
72 + 73+74 = Trptj^i = 1. This means that equation |(25)| 
can be rewritten as 

P(Pd.i) = g^+^'^+-+^'=7i +Q^+^'^ + -+^'' + S2 + 



+ g'/'+^'^ + -+^M73 + 74) 

,J2H Hjfc ("^J + l 



j*/2+J2 + --+J 

+ g- 



= g^'"'-" ■ +g- 
^i2H Vjk (^qj 



r )7i 



■q*''^)(7i +72) + 
(26) 



P{p'd,i) can be also expressed in a similar way, wi th 7^ = 
(XilPd.ilXi) instead of 7j. By combining equations |(26)| for 
-P(pd,i) and P{p'a,i), we get 

J'(Pd,l) - f'(Pd,l) = g^+^-^ + -+^'=(g*/2-^- - g) 

• (71 + 72 - 7; - 72) + + {q ~ l)(7i - 7;). 

Therefore, it suffices to bound I71+72 — 7i— 72I and I71 — 7i|. 
W.l.o.g. we can assume that pd.i is a pure state \Lp){ip\. Let 

\ip) = (ajVoo) + b\ipoi) + c\ipio) + dlV-ii)) ® !V'2) ® • • • ® I?/'*;). 

Then the state after a query is 

= {a\tpoo) - bltpoi) + c\^io) - dIV'ii)) ® |i/'2) ® • • • » liZ-fe) 

and we have to bound 

li-le = \{xt\'P)f - \{xe\'p')f 
for £ G {1, 2}. For ^ = 1, we have 

(XiM = «ao + b(3o + cai + 

The expression for ip' is similar, with minus signs in front of 
6/3o and d/Si. Therefore, 

iKxilv')!^ - Kxil-^')!^! 

< 4|a||6|aoA) + 4|c||d|ai/3i + 4|a||d|ao/3i + 4|6| |c|ai/3o- 

(27) 

Since \a\, \b\, |c|, |dj are a ll at most \\if\\ — 1 and qq, cei are 
less than 1, equation |(27)| is at most 8/3o + 8/3i. Bv lClaim 191 
we have 



171-7^1 < 8/?o + 8/3i < 16^ 



We also have 



|7i + 72 - 7i - 72I 

= iKxil^)!' + l(x2l^)l' - Kxil'^')!' - Kx2l¥''>n 



< 4ja||dj|«o/?i - Qi/3o| +4|6||c||ai/3o - ao/3i| 
8C 



< 8|ao/?i - ai/3oj < 



where C is the big-O constant from IClaim 2*01 By taking 
into account that P{pd,i) > q^^^^^ 



P{W'){V'\)-P{\V){V 
8C 



, 8C 
g)-= + (g- 
ytn 



16V2t 



< (g 



t/2 



1) 



+ (g- 



i)i^lP(MM). (28) 



This proves ILemma 4l for the case when the support of pd,i 
is contained in Ti.4. (If pd,i is a mixed state, we just express 
it as a mixture of pure states \ip). The bound for pd,i follows 
by summing equations | ( 28) | for every \ip).) 

For the general case, we divide the entire state space Hi 
into 4-dimensional subspaces. To do that, we first subdivide 
TCi into subspaces 



(<S'j,o,o ® 5j,o,i ® •S'j.i.o © Sj^i 



>Rj,<g)---<g)Rj^. (29) 



Let states * G [dim5'j,o,ol form a basis for 5*^,0,0 and 

let = UMi:°) for {a,b) g {(0,1), (1 ,0), (1, 1)}, where 

the [7^,, are the unitaries from IClaim H Then the ) 
form a basis for Sj^a.b- 

Let i £ [dim -RjJ, form a basis for , / £ {2, . . . , fc}. 

We subdivide |(29)| into 4-dimensional subspaces -ffii,...,^^ 
spanned by 

IV"?,;') ® IV'2,i2) ® ■ • ■ ® IV'fc.ife), 

where a, & range over {0,1}. Let Tiaii be the col lectio n of 
all Hi-^^...^ii^ obtained by subdividing all subspaces |(29)| We 
claim that 

p(p)= Yl PinHp). (30) 

HeH^u 

Equation |(30)| together with equation |(28)| implies lLemma 41 

Since P{p) is defined as a w eighted sum of traces TrllTj^p, 
we can prove equation |(30) | by showing 



TrHu^pd,! 



E 



Trn7j„,nHPd,i- 



(31) 



To prove [(31)] we define a basis for Tii by first decomposing 
Til into subspaces H £ Tiaii, and then for each subspace, 
taking the b asis co nsisting of |xi), IX2), Ixs) and |x4) defined 
by equation |(24)| By IClaim fTI each of the basis states 
belongs to one of the subspaces TZm- This means that each 
TZm is spanned by some subset of this basis. 

The left hand side of |(31)| is equal to the sum of squared 
projections of pd,i to basis states \xi) that belong to TZm- 
Each of the terms T^tYIti^TIh pd,i on the right hand side is 
equal to the sum of squared projections to basis states \xi) 
that belong to TZm n H. Summing over all H gives the sum 
of squared projections of p d.i to all \xj) that belong to TZm- 
Therefore, the two sides of |(31)|are equal. 



